Choose the Clear Books email route before changing DNS
Clear Books' Business Email Settings guide describes a configurable business email address used across Accounting and Payroll. The documented communications include invoices, quotes, purchase orders, statement balances and employee payslips. Its default method uses a generic Clear Books From address with the business address as Reply-To; the custom method uses the organization's own address. Those are materially different identity arrangements, not interchangeable display preferences.
This guide covers the documented route choices and own-domain SPF setup. The sources used here do not establish a Clear Books-specific customer DKIM generation or activation workflow. That part of the catalogue's broader authentication requirement remains open. Do not fill the gap with a guessed selector, another accounting service's key or an assumption that a custom From address guarantees aligned signing.
The public pages display an August 24 modification label without an unambiguous year in their retained text. They were reviewed on November 9, 2026. Current product applicability and the security methods accepted by an external SMTP provider require confirmation before implementation. This manuscript does not enter a tenant, set credentials or test an invoice or payroll message.
Understand the default From and Reply-To distinction
In the default arrangement, the visible sender is a generic Clear Books system address and the organization's address receives replies through Reply-To. The documented business contact setting supplies that reply address. Do not assume that changing Reply-To changes the identity used by SPF or DKIM. A recipient's reply destination and the authenticated sender identifiers serve different functions. Clear Books Business Email Settings
For the acceptance inventory, record the actual business contact address, the selected route and the intended appearance to recipients. Verify who is responsible for replies, especially where Accounting and Payroll use the same configurable address. A technical authentication review should not silently change a finance team's reply handling or expose payroll messages to an unintended mailbox.
The provider says this default arrangement needs no customer configuration for the described use. That statement is not evidence that a particular account is still on the default route or that every resulting message reaches an inbox. Keep the current account selection and received-message behavior as separate evidence. A remembered original setup is not enough after administrators have changed business settings.
Review own-domain sending through Clear Books
For customers choosing their own domain as the sender while Clear Books performs delivery, the provider requires adding include:_spf.clearbooks.co.uk to the domain's SPF policy. It explicitly warns against overwriting an existing policy wholesale. Preserve this requirement and warning in the proposed change rather than copying the complete example over employee mail or other application authorizations. Clear Books delivery guidance
Identify the authoritative DNS operator, which may not be the registrar or the company that hosts the accounting application. Record the complete current policy, every approved sender that must remain and the exact mechanism being added. The resulting policy should be understandable as an organizational authorization decision, not a collection of unrelated service samples.
A provider example with a soft-fail ending is not permission to change an existing qualifier without review. Preserve the policy owner's intent and assess how the change affects unlisted senders. If the actual sending domain differs from the organization's root domain, do not assume an SPF policy at the parent automatically covers it. Determine the identity used by the route and publish only the approved configuration at the correct owner.
Apply SPF rules to the complete policy
RFC 7208, sections 3.1 and 3.2 specify TXT publication and prohibit multiple records that would cause more than one SPF policy to be selected. A second standalone policy is not an acceptable way to add Clear Books while retaining the first. Merge the required authorization into one coherent policy and preserve its valid syntax.
Section 4.6.4 limits evaluated DNS-dependent terms, including nested work. Review the whole applicable path rather than counting only the new include, visible domain names or actual DNS packets. A cached dependency can still count as an evaluated term. Keep a policy syntax error, excessive evaluation budget and a valid nonmatching result separate in the diagnosis; changing a terminal qualifier does not repair all of them.
RFC 7208, section 2.4 identifies the MAIL FROM identity. The address a customer sees in an invoice is not sufficient evidence of that envelope identity. An authorized harmless message assessment should establish which domain the receiver evaluated, then compare that with the policy being reviewed. A valid record at an unrelated domain does not authenticate the observed route.
Treat external SMTP as a different responsibility boundary
For a public email-provider address, the Business Email Settings guide directs the user to Business, Settings and Use SMTP settings. It explains that this route sends through the customer's email provider rather than Clear Books' servers. The source also directs delivery-support questions for that route to the external email provider. Do not treat the Clear Books SPF include as a universal remedy for an external transport's problem. Clear Books Business Email Settings
The same page contains legacy Yahoo instructions about less-secure sign-in. This manuscript does not recommend enabling that setting or assume it is currently available. Establish the external provider's current supported authentication method and the application's compatibility before any setup. Do not collect credentials in an article worksheet, weaken security settings or promise that an old SMTP example works today.
Record the intended SMTP service and responsible administrator without storing passwords or tokens. A transition to external SMTP is a routing and access decision, not a cosmetic fix. It can change operational ownership and failure diagnosis. Keep approval for the integration separate from approval to publish a DNS record, and leave current compatibility unresolved until supported by account-specific evidence.
Keep DKIM, DMARC and delivery acceptance open
The documented SPF route does not establish a current customer-domain DKIM setup in Clear Books. Obtain applicable provider guidance and actual message evidence before claiming one. Do not infer a key from a familiar selector name, create an unrelated key locally or say that SPF publication completed all authentication requirements. RFC 6376, section 3.5 defines the signing-domain and selector fields that would need assessment in an actual signature.
RFC 9989, section 4.4 explains that a passing authenticated identifier must align with the visible author domain for that mechanism to satisfy DMARC. A passing aligned SPF result or passing aligned DKIM result can meet the authentication condition. This does not guarantee delivery, validate an invoice's bank details or establish that an organization's other senders are ready for a stricter domain policy.
Use harmless content when preparing a separately authorized acceptance exercise. Real payslips, customer balances and purchase orders are unnecessary for checking domains and signature fields. Retain minimal diagnostic evidence under an approved access and retention plan. No real financial correspondence, external upload or test message was used for this guide.
Fictional diagnosis and blank acceptance worksheet
A fictional consultancy, Willow Ledger, changes only its business reply address and expects invoices to show a customer-domain From identity. The review finds that the account still uses the default generic sender route. The proposed next step is to decide which supported route is intended, not to add DNS authorizations blindly. If custom sending is approved, the team will assess its SPF and remaining authentication evidence separately. This fictional example represents no actual account observation or change.
- Account, business address and selected sending route: ______
- Expected From versus Reply-To and reply owner: ______
- Own-domain SPF requirement or external SMTP responsibility: ______
- Existing policy preservation, exact owner and evaluation review: ______
- Current SMTP compatibility, without credentials: ______
- Actual envelope and signature evidence from an authorized test: ______
- Unresolved DKIM guidance, DMARC alignment and release decision: ______
Original implementation evidence, human review, current applicability, production routes, visual accessibility and owner release remain open. This is a route-scoped documentary draft, not a completed Clear Books authentication deployment.